[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-08 Thread Gert Doering
Hi, On Tue, Apr 08, 2025 at 07:43:45PM +0530, Mahesh V wrote: > I dont have that information. > Question remains, why does flex choose m4 binary that is compiled into it > and not from the PATH (env variable) > which m4 and which flex (both exist in the same path) you need to ask that question to

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-08 Thread Guy Harris
On Apr 8, 2025, at 7:13 AM, Mahesh V wrote: > I dont have that information. > Question remains, why does flex choose m4 binary that is compiled into it and > not from the PATH (env variable) > which m4 and which flex (both exist in the same path) That's a good question. I do not know the answ

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-08 Thread Mahesh V
I dont have that information. Question remains, why does flex choose m4 binary that is compiled into it and not from the PATH (env variable) which m4 and which flex (both exist in the same path) On Mon, Apr 7, 2025 at 11:34 PM Guy Harris wrote: > On Apr 7, 2025, at 2:11 AM, Mahesh V > wrote: >

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-07 Thread Francois-Xavier Le Bail via tcpdump-workers
--- Begin Message --- On 06/04/2025 23:28, Michael Richardson wrote: > > Mahesh V wrote: > > I added some code (modified) tcpdump to write the pcapng file. > > while configuring/compiling the source code I get this error > > This is a cross compilation for ARM platform > > Well, like

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-07 Thread Guy Harris
On Apr 7, 2025, at 2:11 AM, Mahesh V wrote: > Flex is not getting built. We have the binary checked in to our repository. What process produced that binary? Is it a binary you compiled, is it a copy of a binary from the OS, or is it from somewhere else? _

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-07 Thread Mahesh V
Flex is not getting built. We have the binary checked in to our repository. "which flex" gives the same path : tools/arm-5.3-uclibc-1.0.12/usr/bin/flex On Mon, Apr 7, 2025 at 2:19 PM Guy Harris wrote: > On Apr 6, 2025, at 11:19 PM, Mahesh V > wrote: > > > configure:7921: checking for flex > >

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-07 Thread Guy Harris
On Apr 6, 2025, at 11:19 PM, Mahesh V wrote: > configure:7921: checking for flex > configure:7937: found tools/arm-5.3-uclibc-1.0.12/usr/bin/flex > configure:7948: result: flex > configure:7986: flex conftest.l > flex: fatal internal error, exec of > /var/tmp/tool-chains/buildroot-2016.02-5.3-ar

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-07 Thread Mahesh V
Forwarded message -- > From: Denis Ovsienko > To: tcpdump-workers@lists.tcpdump.org > Cc: > Bcc: > Date: Mon, 7 Apr 2025 09:09:57 +0100 > Subject: [tcpdump-workers] Re: tcpdump and pcapng with comments > On Mon, 7 Apr 2025 11:49:49 +0530 > Mahesh V wrote: > > > m

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-07 Thread Denis Ovsienko via tcpdump-workers
--- Begin Message --- On Mon, 7 Apr 2025 11:49:49 +0530 Mahesh V wrote: > m4 exists and I have set M4PATH env variable as well In Autoconf "M4" is the optional environment variable with a custom path to m4. -- Denis Ovsienko --- End Message --- _

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-06 Thread Mahesh V
configure:7921: checking for flex configure:7937: found tools/arm-5.3-uclibc-1.0.12/usr/bin/flex configure:7948: result: flex configure:7986: flex conftest.l *flex: fatal internal error, exec of /var/tmp/tool-chains/buildroot-2016.02-5.3-arm/crosstools-arm-gcc-5.3-linux-4.1-uclibc-1.0.12-binutils-2

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-06 Thread Guy Harris
On Apr 6, 2025, at 2:28 PM, Michael Richardson wrote: > Mahesh V wrote: >> I added some code (modified) tcpdump to write the pcapng file. >> while configuring/compiling the source code I get this error >> This is a cross compilation for ARM platform > > Well, likely the resulting flex test can'

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-06 Thread Michael Richardson
Mahesh V wrote: > I added some code (modified) tcpdump to write the pcapng file. > while configuring/compiling the source code I get this error > This is a cross compilation for ARM platform Well, likely the resulting flex test can't be run, since it's cross-compiled. I suggest *NOT

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-06 Thread Mahesh V
Just to clarify, I am building libpcap (where I have added the code) tcpdump compilation is fine but obviously gives symbol error because libpcap is bot yet built. thanks On Sun, Apr 6, 2025 at 2:41 PM Mahesh V wrote: > Hi Folks > > I added some code (modified) tcpdump to write the pcapng file.

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-06 Thread Mahesh V
Hi Folks I added some code (modified) tcpdump to write the pcapng file. while configuring/compiling the source code I get this error This is a cross compilation for ARM platform configure: error: *flex is insufficient to compile libpcap.* libpcap requires Flex 2.5.31 or later, or a compatible ve

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-04 Thread Guy Harris
On Apr 4, 2025, at 11:29 AM, Michael Richardson wrote: > I can't recall if we can read pcapng. libpcap - and thus programs, such as tcpdump, that use libpcap to read capture files - can read some pcapng files, as long as the current libpcap API can handle them. That's been the case since libp

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-04 Thread Michael Richardson
Mahesh V wrote: > I would like to know if > 1) tcpdump can write pcapng format (instead of just pcap) Not yet. > 3) read it later on. (I believe this functionality is available today or > alternatively even wireshark would be ok to do this for me) > Is this functionality ava

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-04 Thread Guy Harris
On Apr 4, 2025, at 10:22 AM, Mahesh V wrote: > I would like to know if > 1) tcpdump can write pcapng format (instead of just pcap) Currently, no. tcpdump uses libpcap to read and write capture files, and libpcap doesn't yet support writing pcapng. > 2) Accept per packet comments from the kern

[tcpdump-workers] Re: tcpdump and pcapng with comments

2025-04-04 Thread Mahesh V
Hello Folks, This is my first post. I would like to know if 1) tcpdump can write pcapng format (instead of just pcap) 2) Accept per packet comments from the kernel and write them along with the packet into the pcapng file (if so, how do we pack the comments from kernel coming from the raw sock